[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_368":369,"_370":371},"routes/_app.x.$handle.$name",{"_100":99,"_32":46,"_108":90,"_27":102,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":60,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",86,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","frontend/components/App.tsx","latestPath","fileId","01a0ab70-d5fe-737e-9de0-a93e3228c701","name","App.tsx","fileType","script","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\nimport { standings } from \"../logic.ts\";\nimport { Icon, PartyForm } from \"./PartyForm.tsx\";\nimport { MatchEditor } from \"./MatchEditor.tsx\";\nimport { AccessGate } from \"./AccessGate.tsx\";\nimport { PlayerDetails, Results } from \"./Results.tsx\";\nimport { useNavigation } from \"../useNavigation.ts\";\nconst short = (p: any) => p.shortName ?? p.name;\nexport function App() {\n const [state, setState] = useState(null),\n [error, setError] = useState(\"\"),\n [notice, setNotice] = useState(\"\"),\n [version, setVersion] = useState(null),\n [canEdit, setCanEdit] = useState(false),\n [locked, setLocked] = useState(false);\n const { route, navigate, back } = useNavigation();\n const [draft, setDraft] = useState({\n ca: \"\",\n cb: \"\",\n date: new Date().toLocaleDateString(\"sv-SE\"),\n });\n const selected = route.view === \"player\" &&\n state?.players.some((p: any) => p.id === route.playerId)\n ? route.playerId\n : null;\n const editing = route.view === \"edit\"\n ? state?.matches.find((m: any) => m.id === route.matchId)\n : null;\n const adding = route.view === \"new\";\n function showPlayer(id: number) {\n navigate({ view: \"player\", playerId: id });\n }\n function backToStand() {\n back();\n }\n async function load() {\n setError(\"\");\n try {\n const r = await fetch(\"/api/state\");\n if (r.status === 401) {\n setLocked(true);\n setCanEdit(false);\n return;\n }\n if (!r.ok) throw Error();\n const d = await r.json();\n setState(d.state);\n setVersion(d.version);\n setCanEdit(!!d.canEdit);\n setLocked(false);\n } catch {\n setError(\"De stand kon niet worden geladen. Probeer het nog eens.\");\n }\n }\n useEffect(() => {\n const params = new URLSearchParams(window.location.hash.slice(1));\n const password = params.get(\"toegang\");\n if (password !== null) {\n window.history.replaceState(\n window.history.state,\n \"\",\n window.location.pathname + window.location.search,\n );\n login(password).catch((e) => {\n setLocked(true);\n setError(e.message);\n });\n } else load();\n }, []);\n async function login(password: string) {\n const r = await fetch(\"/api/login\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password }),\n });\n const d = await r.json();\n if (!r.ok) throw new Error(d.error || \"Inloggen mislukt.\");\n await load();\n }\n async function logout() {\n try {\n const r = await fetch(\"/api/logout\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: \"{}\",\n });\n if (!r.ok) throw Error();\n setState(null);\n setCanEdit(false);\n setLocked(true);\n close();\n setError(\"\");\n } catch {\n setNotice(\"Uitloggen is niet gelukt. Probeer opnieuw.\");\n }\n }\n function open() {\n setNotice(\"\");\n setDraft({ ca: \"\", cb: \"\", date: new Date().toLocaleDateString(\"sv-SE\") });\n navigate({ view: \"new\", step: 0 });\n }\n function close() {\n navigate({ view: \"home\" });\n }\n async function mutate(action: any) {\n const response = await fetch(\"/api/action\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ version, action }),\n });\n const d = await response.json();\n if (!response.ok) {\n if (d.code === \"VISITOR_PASSWORD_REQUIRED\") setLocked(true);\n if (d.code === \"EDIT_PASSWORD_REQUIRED\") setCanEdit(false);\n throw new Error(d.error || \"Opslaan mislukt. Probeer opnieuw.\");\n }\n setState(d.state);\n setVersion(d.version);\n }\n async function add(match: any) {\n await mutate({ type: \"match\", match });\n setNotice(\"Partij opgeslagen.\");\n }\n async function unlock(password: string) {\n const response = await fetch(\"/api/edit-session\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password }),\n });\n const d = await response.json();\n if (!response.ok) throw new Error(d.error || \"Inloggen mislukt.\");\n setCanEdit(true);\n }\n function edit(match: any) {\n navigate({ view: \"edit\", matchId: match.id });\n }\n async function update(match: any) {\n await mutate({ type: \"match\", match });\n back();\n setNotice(\"Uitslag aangepast.\");\n }\n async function remove(id: string) {\n await mutate({ type: \"deleteMatch\", id });\n back();\n setNotice(\"Partij verwijderd.\");\n }\n if (locked) return ;\n if (!state) {\n return (\n

\n Biljartcompetitie BOS\n

Even de stand ophalen.

{error || \"Een momentje…\"}

\n {error && (\n \n )}\n

\n );\n }\n const rows = standings(state),\n matches = [...state.matches].sort((a, b) => b.date.localeCompare(a.date));\n return (\n <>\n

\n {\n e.preventDefault();\n close();\n }}\n >\n Biljartcompetitie BOS\n \n

\n {editing\n ? (\n \n )\n : adding\n ? (\n \n )\n : selected !== null\n ? (\n \n )\n : (\n

Stand

\n {state.matches.length} partijen gespeeld\n

\n \n

\n {notice && (\n

\n \n {notice}\n

\n )}\n

\n \n \n \n \n \n \n \n \n \n \n \n {rows.map((p: any, i: number) => (\n showPlayer(p.id)}\n >\n \n \n \n \n \n \n ))}\n \n

#	Speler	\n Gesp.\n	\n Moy.\n	\n Punten\n
\n \n {i + 1}\n \n	\n {\n e.stopPropagation();\n showPlayer(p.id);\n }}\n aria-label={`Bekijk partijen van ${short(p)}`}\n >\n {short(p)}\n \n {i === 0 && (\n \n )}\n	{p.played}	\n {p.average === null\n ? \"—\"\n : p.average.toLocaleString(\"nl-NL\", {\n minimumFractionDigits: 3,\n maximumFractionDigits: 3,\n })}\n	{p.points}

\n \n

Alle partijen

\n Nieuwste eerst\n

\n {!matches.length\n ? (\n

De tafel is vrij.

\n Voeg de eerste partij toe.\n

\n )\n : (\n \n )}\n \n \n

\n \n

\n )}\n \n );\n}\n","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\nimport { standings } from \"../logic.ts\";\nimport { Icon, PartyForm } from \"./PartyForm.tsx\";\nimport { MatchEditor } from \"./MatchEditor.tsx\";\nimport { AccessGate } from \"./AccessGate.tsx\";\nimport { PlayerDetails, Results } from \"./Results.tsx\";\nimport { useNavigation } from \"../useNavigation.ts\";\nconst short = (p: any) => p.shortName ?? p.name;\nexport function App() {\n const [state, setState] = useState(null),\n [error, setError] = useState(\"\"),\n [notice, setNotice] = useState(\"\"),\n [version, setVersion] = useState(null),\n [canEdit, setCanEdit] = useState(false),\n [locked, setLocked] = useState(false);\n const { route, navigate, back } = useNavigation();\n const [draft, setDraft] = useState({\n ca: \"\",\n cb: \"\",\n date: new Date().toLocaleDateString(\"sv-SE\"),\n });\n const selected = route.view === \"player\" &&\n state?.players.some((p: any) => p.id === route.playerId)\n ? route.playerId\n : null;\n const editing = route.view === \"edit\"\n ? state?.matches.find((m: any) => String(m.id) === route.matchId)\n : null;\n const adding = route.view === \"new\";\n function showPlayer(id: number) {\n navigate({ view: \"player\", playerId: id });\n }\n function backToStand() {\n back();\n }\n async function load() {\n setError(\"\");\n try {\n const r = await fetch(\"/api/state\");\n if (r.status === 401) {\n setLocked(true);\n setCanEdit(false);\n return;\n }\n if (!r.ok) throw Error();\n const d = await r.json();\n setState(d.state);\n setVersion(d.version);\n setCanEdit(!!d.canEdit);\n setLocked(false);\n } catch {\n setError(\"De stand kon niet worden geladen. Probeer het nog eens.\");\n }\n }\n useEffect(() => {\n const params = new URLSearchParams(window.location.hash.slice(1));\n const password = params.get(\"toegang\");\n if (password !== null) {\n window.history.replaceState(\n window.history.state,\n \"\",\n window.location.pathname + window.location.search,\n );\n login(password).catch((e) => {\n setLocked(true);\n setError(e.message);\n });\n } else load();\n }, []);\n async function login(password: string) {\n const r = await fetch(\"/api/login\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password }),\n });\n const d = await r.json();\n if (!r.ok) throw new Error(d.error || \"Inloggen mislukt.\");\n await load();\n }\n async function logout() {\n try {\n const r = await fetch(\"/api/logout\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: \"{}\",\n });\n if (!r.ok) throw Error();\n setState(null);\n setCanEdit(false);\n setLocked(true);\n close();\n setError(\"\");\n } catch {\n setNotice(\"Uitloggen is niet gelukt. Probeer opnieuw.\");\n }\n }\n function open() {\n setNotice(\"\");\n setDraft({ ca: \"\", cb: \"\", date: new Date().toLocaleDateString(\"sv-SE\") });\n navigate({ view: \"new\", step: 0 });\n }\n function close() {\n navigate({ view: \"home\" });\n }\n async function mutate(action: any) {\n const response = await fetch(\"/api/action\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ version, action }),\n });\n const d = await response.json();\n if (!response.ok) {\n if (d.code === \"VISITOR_PASSWORD_REQUIRED\") setLocked(true);\n if (d.code === \"EDIT_PASSWORD_REQUIRED\") setCanEdit(false);\n throw new Error(d.error || \"Opslaan mislukt. Probeer opnieuw.\");\n }\n setState(d.state);\n setVersion(d.version);\n }\n async function add(match: any) {\n await mutate({ type: \"match\", match });\n setNotice(\"Partij opgeslagen.\");\n }\n async function unlock(password: string) {\n const response = await fetch(\"/api/edit-session\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password }),\n });\n const d = await response.json();\n if (!response.ok) throw new Error(d.error || \"Inloggen mislukt.\");\n setCanEdit(true);\n }\n function edit(match: any) {\n navigate({ view: \"edit\", matchId: String(match.id) });\n }\n async function update(match: any) {\n await mutate({ type: \"match\", match });\n back();\n setNotice(\"Uitslag aangepast.\");\n }\n async function remove(id: string) {\n await mutate({ type: \"deleteMatch\", id });\n back();\n setNotice(\"Partij verwijderd.\");\n }\n if (locked) return ;\n if (!state) {\n return (\n

\n Biljartcompetitie BOS\n

Even de stand ophalen.

{error || \"Een momentje…\"}

\n {error && (\n \n )}\n

\n );\n }\n const rows = standings(state),\n matches = [...state.matches].sort((a, b) => b.date.localeCompare(a.date));\n return (\n <>\n

\n {\n e.preventDefault();\n close();\n }}\n >\n Biljartcompetitie BOS\n \n

\n {editing\n ? (\n \n )\n : adding\n ? (\n \n )\n : selected !== null\n ? (\n \n )\n : (\n

Stand

\n {state.matches.length} partijen gespeeld\n

\n \n

\n {notice && (\n

\n \n {notice}\n

\n )}\n

\n \n \n \n \n \n \n \n \n \n \n \n {rows.map((p: any, i: number) => (\n showPlayer(p.id)}\n >\n \n \n \n \n \n \n ))}\n \n

#	Speler	\n Gesp.\n	\n Moy.\n	\n Punten\n
\n \n {i + 1}\n \n	\n {\n e.stopPropagation();\n showPlayer(p.id);\n }}\n aria-label={`Bekijk partijen van ${short(p)}`}\n >\n {short(p)}\n \n {i === 0 && (\n \n )}\n	{p.played}	\n {p.average === null\n ? \"—\"\n : p.average.toLocaleString(\"nl-NL\", {\n minimumFractionDigits: 3,\n maximumFractionDigits: 3,\n })}\n	{p.points}

\n \n

Alle partijen

\n Nieuwste eerst\n

\n {!matches.length\n ? (\n

De tafel is vrij.

\n Voeg de eerste partij toe.\n

\n )\n : (\n \n )}\n \n \n

\n \n

\n )}\n \n );\n}\n","createdAt",["D",1789628357523],"branchVersion","branchId","5ab58193-b7b9-4e57-9c70-3e9498f42f3b","id","72e10bea-a051-405e-a7f1-e9f9c480e56a","biljartcompetitie",["D",1789582693703],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Clubcompetitie: uitslagen, standen en weekformulieren","imageUrl","5db7fd95-a144-4e32-9db1-f1dd5f6c8c16","pinnedFileId","01a0ab70-d5fe-737e-9de0-cce5a2b9f03c","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0ab6b-a1e4-73fe-b072-d871155b5e9e","tursoName","72e10beaa051405ea7f1e9f9c480e56a","tursoHostname","72e10beaa051405ea7f1e9f9c480e56a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789583507842],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_107":102},"org",{"_100":99,"_101":102,"_103":102,"_18":56,"_104":105,"_106":25},"branch",{"_13":14,"_32":90,"_44":43,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":46,"_98":99},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","raymondv","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_32":46,"_39":363,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":364,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":365,"_85":366,"_87":367,"_89":25},"tree",[184,202,204,205,206],"files",[184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206],"counts",{"_173":64,"_174":157,"_175":64,"_176":177,"_178":179},"contents",[129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":168,"_32":169,"_30":170,"_136":-5,"_42":43,"_41":157,"_138":60,"_39":171,"_13":64,"_34":166,"_36":-5,"_24":25,"_143":-5,"_27":172},{"_44":161,"_32":162,"_30":163,"_136":-5,"_42":43,"_41":164,"_138":60,"_39":165,"_13":64,"_34":166,"_36":-5,"_24":25,"_143":-5,"_27":167},{"_44":154,"_32":155,"_30":156,"_136":-5,"_42":43,"_41":157,"_138":60,"_39":158,"_13":64,"_34":20,"_36":159,"_24":25,"_143":-5,"_27":160},{"_44":146,"_32":147,"_30":148,"_136":-5,"_42":43,"_41":149,"_138":60,"_39":150,"_13":151,"_34":20,"_36":152,"_24":25,"_143":-5,"_27":153},{"_44":134,"_32":135,"_30":58,"_136":-5,"_42":43,"_41":137,"_138":60,"_39":139,"_13":140,"_34":141,"_36":142,"_24":25,"_143":144,"_27":145},"7d08e693-0634-483c-b8b3-3142f5539c5e","index.ts","parentId",60,"latest",["D",1789589116067],8,"http","import {\n parseVal,\n serveImmutableFile,\n} from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono@4\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { applyAction, displayState } from \"./frontend/logic.ts\";\nimport {\n digest,\n needsEditPassword,\n SESSION_MS,\n sessionCookie,\n sessionToken,\n token,\n verifyPassword,\n VISITOR_COOKIE,\n VISITOR_SECONDS,\n} from \"./server/auth.ts\";\nconst app = new Hono();\nasync function visitorSession(c: any) {\n const value = sessionToken(c.req.raw, VISITOR_COOKIE);\n if (!value) return false;\n const tokenHash = await digest(value);\n const r = await sqlite.execute({\n sql:\n \"SELECT credential_kind,credential_hash FROM visitor_sessions WHERE token_hash=? AND expires_at>?\",\n args: [tokenHash, Date.now()],\n });\n if (!r.rows.length) return false;\n const row = r.rows[0];\n const verifier = Deno.env.get(\n row.credential_kind === \"admin\"\n ? \"BOS_EDIT_PASSWORD_HASH\"\n : \"BOS_VISITOR_PASSWORD_HASH\",\n );\n if (!verifier || row.credential_hash !== await digest(verifier)) return false;\n if (c.req.path === \"/api/state\") {\n await sqlite.execute({\n sql: \"UPDATE visitor_sessions SET expires_at=? WHERE token_hash=?\",\n args: [Date.now() + VISITOR_SECONDS * 1000, tokenHash],\n });\n const adminVerifier = Deno.env.get(\"BOS_EDIT_PASSWORD_HASH\");\n if (adminVerifier) {\n await sqlite.execute({\n sql:\n \"UPDATE edit_sessions SET expires_at=? WHERE token_hash=? AND credential_hash=? AND expires_at>?\",\n args: [\n Date.now() + SESSION_MS,\n tokenHash,\n await digest(adminVerifier),\n Date.now(),\n ],\n });\n }\n c.header(\n \"Set-Cookie\",\n sessionCookie(value, VISITOR_COOKIE, VISITOR_SECONDS),\n { append: true },\n );\n }\n return true;\n}\nasync function startVisitorSession(c: any, verifier: string, kind: string) {\n const value = token();\n await sqlite.batch([\n {\n sql: \"DELETE FROM visitor_sessions WHERE expires_at<=?\",\n args: [Date.now()],\n },\n {\n sql:\n \"INSERT INTO visitor_sessions(token_hash,credential_hash,credential_kind,expires_at) VALUES(?,?,?,?)\",\n args: [\n await digest(value),\n await digest(verifier),\n kind,\n Date.now() + VISITOR_SECONDS * 1000,\n ],\n },\n ], \"write\");\n c.header(\n \"Set-Cookie\",\n sessionCookie(value, VISITOR_COOKIE, VISITOR_SECONDS),\n { append: true },\n );\n return value;\n}\nasync function canEdit(req: Request) {\n const value = sessionToken(req, VISITOR_COOKIE),\n verifier = Deno.env.get(\"BOS_EDIT_PASSWORD_HASH\");\n if (!value || !verifier) return false;\n const r = await sqlite.execute({\n sql:\n \"SELECT 1 FROM edit_sessions WHERE token_hash=? AND credential_hash=? AND expires_at>?\",\n args: [await digest(value), await digest(verifier), Date.now()],\n });\n return r.rows.length > 0;\n}\nasync function identity(req: Request) {\n const session = await getOAuthUserData(req);\n if (!session?.user) return { editor: false, owner: false, username: null };\n const r = await sqlite.execute({\n sql:\n \"SELECT role FROM admins WHERE user_id=? OR (user_id IS NULL AND lower(username)=lower(?))\",\n args: [session.user.id, session.user.username ?? \"\"],\n });\n return {\n editor: r.rows.length > 0,\n owner: r.rows.some((r) => r.role === \"owner\"),\n username: session.user.username,\n };\n}\nasync function current() {\n const r = await sqlite.execute(\n \"SELECT version,data FROM competition WHERE id=1\",\n );\n if (!r.rows.length) throw new Error(\"Competitie nog niet ingericht\");\n return {\n version: Number(r.rows[0].version),\n state: JSON.parse(String(r.rows[0].data)),\n };\n}\napp.use(\"/api/*\", async (c, next) => {\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n if (![\"GET\", \"HEAD\"].includes(c.req.method)) {\n if (\n c.req.header(\"Origin\") !== new URL(c.req.url).origin ||\n !c.req.header(\"Content-Type\")?.startsWith(\"application/json\")\n ) return c.json({ error: \"Ongeldige aanvraag.\" }, 403);\n }\n if (\n ![\n \"/api/login\",\n \"/api/logout\",\n \"/api/edit-session\",\n \"/api/edit-session/logout\",\n ].includes(c.req.path) && !await visitorSession(c)\n ) {\n return c.json({\n error: \"Vul het bezoekerswachtwoord in.\",\n code: \"VISITOR_PASSWORD_REQUIRED\",\n }, 401);\n }\n await next();\n});\napp.get(\"/api/state\", async (c) => {\n const data = await current(), user = await identity(c.req.raw);\n return c.json({\n ...data,\n state: displayState(data.state, user.editor),\n user,\n canEdit: await canEdit(c.req.raw),\n });\n});\napp.post(\"/api/login\", login);\napp.post(\"/api/edit-session\", login);\nasync function login(c: any) {\n const adminVerifier = Deno.env.get(\"BOS_EDIT_PASSWORD_HASH\");\n const visitorVerifier = Deno.env.get(\"BOS_VISITOR_PASSWORD_HASH\");\n if (!adminVerifier || !visitorVerifier) {\n return c.json({ error: \"Het wachtwoord is nog niet ingesteld.\" }, 503);\n }\n const raw = await c.req.text();\n if (raw.length > 2048) return c.json({ error: \"Aanvraag te groot.\" }, 413);\n let password;\n try {\n password = JSON.parse(raw).password;\n } catch {\n return c.json({ error: \"Ongeldige aanvraag.\" }, 400);\n }\n // Atomic, account-wide cap; never trust a client-supplied IP header.\n const bucket = Math.floor(Date.now() / (15 * 60 * 1000));\n const attempts = await sqlite.execute({\n sql:\n \"INSERT INTO edit_login_limits(bucket,attempts) VALUES(?,1) ON CONFLICT(bucket) DO UPDATE SET attempts=attempts+1 WHERE attempts<30 RETURNING attempts\",\n args: [bucket],\n });\n if (!attempts.rows.length) {\n c.header(\n \"Retry-After\",\n String(Math.ceil(((bucket + 1) * 900000 - Date.now()) / 1000)),\n );\n return c.json({\n error: \"Te veel pogingen. Probeer het over een kwartier opnieuw.\",\n }, 429);\n }\n const isAdmin = await verifyPassword(password, adminVerifier);\n const isVisitor = c.req.path === \"/api/login\" && !isAdmin &&\n await verifyPassword(password, visitorVerifier);\n if (!isAdmin && !isVisitor) {\n return c.json({ error: \"Het wachtwoord klopt niet.\" }, 401);\n }\n const verifier = isAdmin ? adminVerifier : visitorVerifier;\n const value = await startVisitorSession(\n c,\n verifier,\n isAdmin ? \"admin\" : \"visitor\",\n );\n if (!isAdmin) return c.json({ canEdit: false });\n await sqlite.batch([\n {\n sql: \"DELETE FROM edit_sessions WHERE expires_at<=?\",\n args: [Date.now()],\n },\n { sql: \"DELETE FROM edit_login_limits WHERE bucket {\n const value = sessionToken(c.req.raw, VISITOR_COOKIE);\n if (value) {\n await sqlite.execute({\n sql: \"DELETE FROM visitor_sessions WHERE token_hash=?\",\n args: [await digest(value)],\n });\n }\n if (value) {\n await sqlite.execute({\n sql: \"DELETE FROM edit_sessions WHERE token_hash=?\",\n args: [await digest(value)],\n });\n }\n c.header(\"Set-Cookie\", sessionCookie(\"\", VISITOR_COOKIE), { append: true });\n return c.json({ ok: true });\n});\napp.post(\"/api/edit-session/logout\", async (c) => {\n const value = sessionToken(c.req.raw, VISITOR_COOKIE);\n if (value) {\n await sqlite.execute({\n sql: \"DELETE FROM edit_sessions WHERE token_hash=?\",\n args: [await digest(value)],\n });\n }\n return c.json({ canEdit: false });\n});\napp.get(\"/api/history\", async (c) => {\n if (!(await identity(c.req.raw)).editor) {\n return c.json({ error: \"Log in als beheerder.\" }, 401);\n }\n const r = await sqlite.execute(\n \"SELECT id,version,actor,action,created_at FROM history ORDER BY id DESC LIMIT 150\",\n );\n return c.json(r.rows);\n});\napp.get(\"/api/export\", async (c) => {\n if (!(await identity(c.req.raw)).editor) {\n return c.json({ error: \"Log in als beheerder.\" }, 401);\n }\n const results = await sqlite.batch([{\n sql: \"SELECT version,data FROM competition WHERE id=1\",\n }, { sql: \"SELECT * FROM history ORDER BY id\" }], \"read\");\n return new Response(\n JSON.stringify(\n {\n format: \"biljartcompetitie-v1\",\n exportedAt: new Date().toISOString(),\n version: Number(results[0].rows[0].version),\n state: JSON.parse(String(results[0].rows[0].data)),\n history: results[1].rows,\n },\n null,\n 2,\n ),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Content-Disposition\":\n 'attachment; filename=\"biljartcompetitie-backup.json\"',\n \"Cache-Control\": \"no-store\",\n },\n },\n );\n});\napp.get(\"/api/results.csv\", async (c) => {\n const { state: raw } = await current();\n const state = displayState(raw);\n const q = (s: any) =>\n '\"' + String(s).replace(/^([=+@-])/, \"'$1\").replaceAll('\"', '\"\"') + '\"';\n const name = (id: number) => state.players.find((p: any) => p.id === id).name;\n const lines = [\n [\n \"Demonstratie\",\n \"Datum\",\n \"Speler A\",\n \"Caramboles A\",\n \"Speler B\",\n \"Caramboles B\",\n ],\n ...state.matches.map((\n m: any,\n ) => [state.demo ? \"JA\" : \"NEE\", m.date, name(m.a), m.ca, name(m.b), m.cb]),\n ];\n return new Response(\n \"\\uFEFF\" + lines.map((r) => r.map(q).join(\";\")).join(\"\\r\\n\"),\n {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\": 'attachment; filename=\"uitslagen.csv\"',\n },\n },\n );\n});\napp.post(\"/api/action\", async (c) => {\n const u = await identity(c.req.raw);\n if (Number(c.req.header(\"Content-Length\") ?? 0) > 10000) {\n return c.json({ error: \"Aanvraag te groot.\" }, 413);\n }\n const body = await c.req.json();\n if (needsEditPassword(body?.action) && !await canEdit(c.req.raw)) {\n return c.json({\n error: \"Vul het wachtwoord in om een partij te wijzigen of verwijderen.\",\n code: \"EDIT_PASSWORD_REQUIRED\",\n }, 401);\n }\n if (!u.editor && ![\"match\", \"deleteMatch\"].includes(body?.action?.type)) {\n return c.json({ error: \"Deze wijziging is alleen voor beheerders.\" }, 403);\n }\n const old = await current();\n if (!Number.isSafeInteger(body.version) || body.version !== old.version) {\n return c.json({\n error:\n \"Iemand heeft intussen gegevens gewijzigd. Vernieuw de pagina en voer je wijziging opnieuw in.\",\n }, 409);\n }\n let state;\n try {\n state = applyAction(old.state, body.action, u.owner);\n } catch (e) {\n return c.json({ error: e.message }, 400);\n }\n const r = await sqlite.execute({\n sql:\n \"UPDATE competition SET data=?,version=version+1,actor=?,action=? WHERE id=1 AND version=? RETURNING version\",\n args: [\n JSON.stringify(state),\n u.username ??\n (needsEditPassword(body.action)\n ? \"spelleider (wachtwoord)\"\n : \"openbare invoer\"),\n JSON.stringify(body.action),\n body.version,\n ],\n });\n if (!r.rows.length) {\n return c.json({\n error:\n \"Gelijktijdige wijziging. Vernieuw de pagina voordat je opnieuw opslaat.\",\n }, 409);\n }\n return c.json({\n state: displayState(state, u.editor),\n version: Number(r.rows[0].version),\n user: u,\n });\n});\napp.get(\"/api/admins\", async (c) => {\n if (!(await identity(c.req.raw)).owner) {\n return c.json({ error: \"Alleen de eigenaar.\" }, 403);\n }\n return c.json(\n (await sqlite.execute(\n \"SELECT username,role FROM admins ORDER BY role,username\",\n )).rows,\n );\n});\napp.post(\"/api/admins\", async (c) => {\n const u = await identity(c.req.raw);\n if (!u.owner) return c.json({ error: \"Alleen de eigenaar.\" }, 403);\n const b = await c.req.json();\n if (\n typeof b.username !== \"string\" || !/^[a-zA-Z0-9_-]{1,40}$/.test(b.username)\n ) {\n return c.json(\n { error: \"Vul een geldige Val Town-gebruikersnaam in.\" },\n 400,\n );\n }\n if (b.remove) {\n await sqlite.execute({\n sql:\n \"DELETE FROM admins WHERE lower(username)=lower(?) AND role='editor'\",\n args: [b.username],\n });\n } else {await sqlite.execute({\n sql:\n \"INSERT OR IGNORE INTO admins(username,role) VALUES(lower(?),'editor')\",\n args: [b.username],\n });}\n return c.json({ ok: true });\n});\napp.get(\"/\", (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n return c.html(Root());\n});\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.onError((err) => {\n console.error(err);\n return Response.json({\n error:\n \"Opslaan of laden is niet gelukt. Probeer opnieuw; je invoer blijft staan.\",\n }, { status: 500 });\n});\nexport default oauthMiddleware(app.fetch);\n","label","bos",[135],"eb5daa04-66b8-439f-ba01-4b49fd912161","README.md","01a0ab70-d5fe-737e-9de0-cbc1b6eaafd1",46,["D",1789587970208],4,"# Biljartcompetitie\n\nApp: [Open de app](url:index.ts) — https://bos.val.run/ Val:\nhttps://www.val.town/x/raymondv/biljartcompetitie\n\n## Actuele richting: eenvoudig mobiel ontwerp\n\nDe homepage toont nu de tussenstand en daaronder alle partijen, nieuwste datum\neerst. **Nieuwe partij** is voor iedereen klikbaar: kies jezelf, kies een nog\nbeschikbare tegenstander, vul beide scores en de datum in. Vandaag is vooraf\ningevuld.\n\nDit is bewust een frontendprototype: toevoegen past uitsluitend de tijdelijke\nbrowserweergave aan. Vernieuwen herstelt de online stand. Er worden geen\nopenbare wijzigingen naar de database geschreven. Formulieren, login en beheer\nzijn uit de nieuwe voorkant gehaald; de eerdere serverfuncties zijn behouden\nvoor later.\n\nVormgeving: `frontend/style.css`. Invoer: `frontend/components/PartyForm.tsx`.\nLokale voorbeeldserver: `node tests/preview-server.ts` (poort 4173), met een\nkopie van de getranspileerde clientmodules in `preview/`. Testdata blijven\nlokaal.\n\nDe onderstaande beschrijving documenteert de eerdere versie en backend.\n\n## Eerdere versie: gebruik\n\n- Bezoekers zien standen, uitslagen, nog mogelijke tegenstanders en\n weekformulieren.\n- Alle openbare namen zijn unieke afkortingen van 4 letters; bij botsingen 5\n letters en zo nodig een deelnemersnummer. Volledige namen worden uitsluitend\n aan ingelogde beheerders geleverd.\n- Log in met Val Town. De eigenaar beheert de toegang van spelleiders via hun\n exacte Val Town-gebruikersnaam. Een gratis account volstaat.\n- De app start als demonstratie met 60 fictieve uitslagen uit het aangeleverde\n Excelbestand. De eigenaar kan via Beheer expliciet een lege echte competitie\n starten. Startmoyennes zijn onbekend en worden niet verzonnen.\n- De 16 deelnemers kunnen hernoemd worden en hebben bewerkbare startmoyennes.\n Naamscorrecties gelden ook voor eerdere uitslagen; een persoon vervangen\n midden in een seizoen vereist aparte migratie.\n- Elke speler heeft 20 beurten. Winst 2 punten, gelijk 1, verlies 0. Sortering:\n punten, actueel moyenne, bij volledige gelijkstand oorspronkelijke\n deelnemersvolgorde. Geen handicapberekening.\n- Download wekelijks de JSON-back-up onder Beheer. Deze bevat de volledige stand\n en alle wijzigingsmomenten. CSV bevat uitslagen met afkortingen. Geen\n automatische externe back-up ingesteld.\n- Print: Weekformulier, kies actueel of blanco. A4 staand, 100%, browserkop- en\n voetteksten uit. Het blanco formulier toont geen uitslagstatus of actuele\n punten.\n\n## Techniek en onderhoud\n\nReact 18.2, Hono en Val Town SQLite (`std/sqlite/main.ts`, val-scoped). Geen\nbetaald extern systeem, geen persoonlijke cloudschijven.\n\n- `index.ts`: API, OAuth-rollencontrole, CSRF-controle, export en\n frontend-routes.\n- `frontend/logic.ts`: spelregels, validatie en afkortingen.\n- `frontend/components/App.tsx`: navigatie en schermen.\n- `frontend/components/Forms.tsx`: uitslagformulier, stand, deelnemersbeheer.\n- `frontend/components/WeekForm.tsx` en `frontend/print.css`: A4-formulieren.\n- `frontend/root.tsx`: HTML-shell en versiegebonden assets.\n\nDatabase:\n\n- `competition`: één JSON-document met spelers/uitslagen en een integer\n `version`.\n- `history`: SQLite-trigger bewaart elke wijziging atomair met oude/nieuwe\n stand, actor en actie.\n- `admins`: eigenaar op onveranderlijk Val Town-user-ID; spelleiders op\n toegekende gebruikersnaam.\n- `access_check`: lege tabel voor toegangstests.\n\nUpdates gebruiken `WHERE version = ?` plus `RETURNING`; een verouderde update\ngeeft HTTP 409. Servervalidatie weigert ontbrekende scores,\nnegatieve/breuk-scores, ongeldige datums, dezelfde speler en dubbele paren in\nbeide richtingen.\n\nCodex kan via de Val Town-plugin code en de val-database onderhouden. Namen en\nuitslagen staan in de database, niet in de publieke broncode. Publiceer geen\nlokale `data/` of back-upbestanden als broncode.\n\nHerstel door Codex: valideer een JSON-back-up, exporteer eerst de huidige stand,\nvoer daarna een parametergebonden update van `competition` uit met\nversiecontrole, hogere versie en herstelactie. De trigger bewaart de eerdere\nstand. Verwijder de geschiedenis niet stilzwijgend.\n",[147],"acbbe75b-ff67-4cfd-b38a-7945edc6d22a","CHANGELOG.md","01a0ab70-d5fe-737e-9de0-c50f1a113208",1,["D",1789582693703],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

Diff · v86